Robert
The acl should not stop devices within the same vlan talking to each other, it only stops devices outside that vlan so what you are seeing is not right.
In terms of your general question, usually you use inbound acls on the source vlan rather than outbound acls on the destination vlan. You can use either but blocking packets at the source is the more common approach.
So if i understand correctly you need to block all traffic between any vlan 10.2.x.x/24 subnet ?
If so and you are not bothered about specifying the source IP subnet in each acl -
ip access-list extended
deny ip any 10.2.0.0 0.0.255.255
permit ip any any
int vlan 10
ip access-group in
so lets say vlan 10 is 10.2.5.0/24. What the above does is block any packets coming from clients in vlan 10 with a destination IP of 10.2.x.x. Any other packets will be allowed. This same acl could be applied to all 10.2.x.x L3 vlan interfaces.
Note that in the acl i used the source of any rather than "10.2.5.0 0.0.0.255". This is because with "any" the same acl could be applied to all the 10.2.x.x vlans inbound without any modification. You could if you wanted to be more precise do a specific acl for each vlan ie. for the same example above -
ip access-list extended
deny ip 10.2.5.0 0.0.0.255 10.2.0.0 0.0.255.255
permit ip 10.2.5.0 0.0.0.255 any
this would be more specific and would stop any non 10.2.5.x client on that vlan from sending packets but most communication wouldn't work anyway as the return packets would not be routed properly to the client. But as i say this makes the acl unique to the specific vlan so you would need different acls per vlan.
Some additional points -
1) if the clients use DHCP and the DHCP server is a 10.2.x.x device you would need to allow that before the deny line
2) the clients will not be able to ping their default gateway ie the L3 vlan interface. This is not a problem because the destination IP is never usually the L3 vlan interface but if you wanted to be able to do that you would need a permit line before the deny line. Note also that this would mean your acl would be different for each vlan because the L3 vlan IP is different per vlan
3) if you use the same actual acl for every vlan interface then any hits on the acl will be for all vlans so you won't be able to see the hits per vlan. This may or may not be important to you. That is often why you seen unique acls (in terms of number or name but not necessarily entries) used. If you do want to see the hits per vlan then simply replicate the acl but with a new name per acl (assuming you go with the option of using "any" in your acls).
Hope all that made sense. Any doubts please ask further.
Jon
